Cuba is a double extortion ransomware operation that broke into victims through unpatched Microsoft Exchange servers, phishing, stolen credentials and remote access, then used Windows privilege escalation flaws and a signed kernel driver to switch off security tools before encrypting. The FBI and CISA reported in joint advisory AA22-335A (December 2022) that Cuba actors had compromised 101 entities, 65 of them in the United States, demanded more than $145 million and received at least $60 million in ransom payments as of August 2022. This profile draws on that advisory, MITRE ATT&CK, Mandiant and Palo Alto Networks Unit 42 to explain how the group operated and what defenders should prioritise. It is written for security operations, infrastructure and identity teams. It reflects the government and vendor research named on this page as of November 2026; newer activity may not be covered.
Key takeaways
- Critical infrastructure was a deliberate target. The FBI and CISA list financial services, government facilities, healthcare and public health, critical manufacturing and information technology among the sectors hit.
- Exchange was a front door. Mandiant observed the group exploiting the ProxyShell and ProxyLogon Microsoft Exchange vulnerability chains for initial access, likely from as early as August 2021, followed by web shells.
- Identity was the path to domain control. The advisory describes Kerberoasting of service accounts, theft of cached Kerberos tickets from LSASS and ZeroLogon (CVE-2020-1472) to gain Domain Administrator rights.
- Security tools were attacked directly. A dropper installed the ApcHelper.sys kernel driver, signed with a certificate leaked from NVIDIA, to terminate security products.
- The name is not a nation. The FBI and CISA state there is no indication the actors have any connection or affiliation with the Republic of Cuba.
Who they are (names and aliases)
MITRE ATT&CK tracks the ransomware as software S0625 (Cuba), describing a Windows-based family used against financial, technology and logistics organisations in North and South America and Europe since at least December 2019. Vendors track the operators under their own names.
| Name | Used by | Refers to |
|---|---|---|
| Cuba ransomware | FBI, CISA, MITRE ATT&CK (S0625) | The ransomware and its operators |
| COLDDRAW | Mandiant | The ransomware payload, which appends .cuba to encrypted files |
| UNC2596 | Mandiant | The cluster deploying COLDDRAW |
| Tropical Scorpius | Palo Alto Networks Unit 42 | The group deploying Cuba ransomware |
The joint advisory also records two linked threads. Cuba actors used the RomCom remote access trojan for command and control, and the advisory describes RomCom actors running campaigns with trojanised versions of legitimate software (SolarWinds Network Performance Monitor, KeePass, PDF Reader Pro and Advanced IP Scanner) hosted on spoofed domains. It also notes a suspected link to the Industrial Spy ransomware and data market: from around May 2022 Cuba actors moved from selling stolen data on their own leak site to selling it on Industrial Spy's marketplace. Treat both as reported associations, not proof of a single organisation.
Targeting and motivation
The motive is financial. The group ran double extortion: steal data, encrypt systems, demand payment for decryption and threaten to publish or sell the data. Scale grew quickly. The FBI's December 2021 Flash, as cited by Unit 42, reported at least $43.9 million in payments against at least $74 million demanded; by August 2022 the joint advisory put the figures at $60 million received against $145 million demanded, and said the number of US victims had doubled since the Flash.
| Source | Sectors or victims reported |
|---|---|
| FBI and CISA, AA22-335A | 101 entities as of August 2022 (65 US, 36 elsewhere); financial services, government facilities, healthcare and public health, critical manufacturing, information technology |
| Mandiant (February 2022) | Dozens of organisations in more than ten countries, about 80% in North America; utilities, government, organisations supporting non-profits and healthcare |
| Unit 42 (August 2022) | 60 leak site victims since 2019, 40 in the US; manufacturing most listed, then professional and legal services, financial services and construction |
Unit 42 points out that victims who pay are often not listed, so leak site counts understate the true number.
Tactics and techniques (MITRE ATT&CK)
The table maps behaviours reported by the FBI and CISA, Mandiant and Unit 42 to ATT&CK v20 techniques. Security tool tampering is mapped to T1685 Disable or Modify Tools in the v20 Defense Impairment tactic, which replaced the technique ID used in the 2022 advisory.
| Tactic | Technique | Reported behaviour |
|---|---|---|
| Resource Development | T1584.001 Domains | Spoofed domains hosting trojanised software (RomCom campaign) |
| Initial Access | T1190 Exploit Public-Facing Application | Known vulnerabilities in commercial software; ProxyShell and ProxyLogon on Exchange |
| Initial Access | T1566 Phishing | Phishing as an entry route |
| Initial Access | T1078 Valid Accounts; T1133 External Remote Services | Compromised credentials and remote access services |
| Persistence | T1505.003 Web Shell | Web shells on exploited Exchange servers |
| Persistence | T1136 Create Account | Created an account and added it to administrator and RDP groups (Mandiant) |
| Execution | T1059.001 PowerShell; T1072 Software Deployment Tools | Obfuscated PowerShell; Hancitor loader distributing the ransomware |
| Privilege Escalation | T1068 Exploitation for Privilege Escalation | CVE-2022-24521 (Windows CLFS driver) for SYSTEM tokens; CVE-2020-1472 (ZeroLogon) for Domain Admin |
| Defense Impairment | T1685 Disable or Modify Tools | ApcHelper.sys driver and the BURNTCIGAR tool terminating security processes |
| Credential Access | T1558.003 Kerberoasting; T1003.001 LSASS Memory | Service account tickets cracked offline; cached Kerberos tickets extracted from LSASS |
| Lateral Movement | T1563.002 RDP Hijacking; T1021.002 SMB/Windows Admin Shares | Legitimate RDP sessions; RDP, SMB and PsExec (Mandiant) |
| Command and Control | T1090 Proxy; T1219 Remote Access Tools | Reverse shell through an HTTP/HTTPS proxy; NetSupport RAT (Mandiant) |
| Impact | T1489 Service Stop; T1486 Data Encrypted for Impact | Hardcoded list of services and processes to stop; files encrypted with the .cuba extension |
Both CVEs in the table are in the CISA Known Exploited Vulnerabilities catalogue with known ransomware use: CVE-2020-1472 added on 3 November 2021 and CVE-2022-24521 on 13 April 2022. See the CISA KEV Catalogue Guide for how to prioritise against it.
How they abuse identities and credentials
Cuba intrusions show how quickly a foothold becomes domain control when service accounts and domain controllers are weak points.
- Service accounts: the advisory describes a PowerShell script identifying service accounts, then Kerberoasting their tickets and cracking them offline. Service accounts with long-lived, guessable passwords and broad rights are the prize. See the Kerberoasting and AS-REP Roasting Defence Guide.
- Cached tickets: a tool Unit 42 calls KerberCache extracted cached Kerberos tickets from LSASS memory, letting operators reuse existing sessions.
- Domain controllers: ZeroLogon gave Domain Administrator rights by obtaining an NTLM hash from a domain controller, according to Unit 42.
- New admin accounts: Mandiant saw the group create an account and add it to administrator and RDP groups, which is why the advisory asks defenders to review domain controllers and Active Directory for unrecognised accounts.
- Remote access: valid credentials over RDP and external remote services were both an entry route and the main lateral movement channel.
Recovery after this kind of intrusion means treating every privileged and service credential as exposed. The Recovering IAM and PAM After Ransomware or Domain Compromise guide sets out the order of work.
Notable activity
- 2019: MITRE ATT&CK dates the ransomware to at least December 2019, and Mandiant found a leak site entry suggesting activity as early as November 2019.
- 2021: Mandiant observed exploitation of Exchange ProxyShell and ProxyLogon, likely from August 2021. The FBI issued a Flash on Cuba indicators in December 2021.
- 2022: Unit 42 reported new tooling (the RomCom RAT, the ApcHelper.sys driver, a CVE-2022-24521 exploit and KerberCache) in August 2022. The FBI and CISA published AA22-335A on 1 December 2022 and updated it on 12 December 2022 with further indicators.
The advisory warns that several of its IP indicators were more than a year old at publication and should be vetted before blocking. Treat published indicators as hunting leads, not block lists.
Detection and defence
Defences follow the intrusion path. The priorities below come from the advisory's mitigations, Unit 42's recommendations and the techniques above.
| Stage | Prevent | Detect |
|---|---|---|
| Exchange and edge systems | Patch internet-facing systems against KEV entries first; the advisory names SonicWall firewall vulnerabilities as a priority. Retire or isolate unsupported Exchange servers. | New files in Exchange web directories; IIS worker processes spawning shells |
| Credentials and remote access | MFA on webmail, VPN and critical systems; close unused remote access | RDP logons from unusual sources; Event ID 4624 logon type 10 spikes |
| Service accounts | Long random passwords or managed service accounts; AES-only Kerberos | Event ID 4769 bursts with RC4 encryption type (0x17) |
| Domain controllers | Apply the Netlogon (CVE-2020-1472) updates and enforcement mode | Netlogon events 5827 to 5829 on domain controllers; new members of privileged groups (Event ID 4728, 4732, 4756) |
| Security tooling | Microsoft vulnerable driver blocklist, HVCI and tamper protection | New kernel service installs (System Event ID 7045); security agents going silent |
| Recovery | Offline, encrypted, immutable backups in a separate segment | Backup job failures or deletions; mass service stops |
Practical points:
- Logging: Unit 42 recommends Sysmon, command-line and PowerShell logging forwarded to a SIEM, plus hunting for security-product tampering, service-account lateral movement and unusual Domain Admin behaviour.
- Driver abuse: both the ApcHelper.sys driver and BURNTCIGAR's abuse of a vulnerable Avast driver are examples of the pattern covered in the Bring Your Own Vulnerable Driver and EDR Killers Guide; the EDR Tampering and BYOVD Response Playbook covers the response.
- Exchange hardening: see the Microsoft Exchange Server Security Guide.
- Least privilege: the advisory recommends auditing admin accounts, just-in-time administration and restricting command-line and scripting permissions.
- Email: it also recommends banners on external email and disabling hyperlinks in received mail.
Metrics that show progress: median days to patch KEV-listed internet-facing vulnerabilities; percentage of service accounts with managed or 25-plus character passwords; count of privileged accounts with standing access; percentage of hosts with tamper protection and the driver blocklist enforced; backup restore test success rate.
Common failure patterns
- Patching Exchange late: ProxyShell and ProxyLogon were public and patched months before Mandiant saw them exploited by this group.
- Kerberoastable service accounts: service principal names on accounts with short, old passwords and domain admin rights.
- Unpatched domain controllers: ZeroLogon remained usable for privilege escalation long after its 2020 fix.
- Trusting signed drivers: the ApcHelper.sys driver carried a valid signature from a leaked certificate, so signature checks alone did not stop it.
- Backups reachable from the domain: backups that domain admin credentials can delete do not survive this playbook.
- Stale indicator blocking: relying on old IP lists instead of behaviour-based detection.
Practitioner checklist
- Patch or retire internet-facing Exchange servers and prioritise KEV-listed edge vulnerabilities.
- Confirm Netlogon enforcement and CVE-2022-24521 updates across all Windows systems.
- Require MFA for webmail, VPN, RDP gateways and privileged access.
- Find every account with a service principal name and rotate it to a managed or long random password.
- Alert on new privileged group members, new kernel services and security agents going offline.
- Enforce the vulnerable driver blocklist, HVCI and EDR tamper protection.
- Keep offline, immutable backups outside the domain and test restores.
- Hunt with the advisory's indicators, vetting age first, and prefer behaviour detections.
Standards and references
- CISA and FBI: #StopRansomware: Cuba Ransomware (AA22-335A)
- FBI IC3: Joint Cybersecurity Advisory AA22-335A (PDF)
- MITRE ATT&CK: Cuba (S0625)
- CISA: Known Exploited Vulnerabilities Catalog
- Mandiant: UNC2596, Cuba Ransomware
- Palo Alto Networks Unit 42: Tropical Scorpius and Cuba Ransomware
Related NHI Mgmt Group resources: Ransomware Groups Guide, ATT&CK Ransomware Software Hub, Backup Security and Immutable Backup Guide, Remote Desktop (RDP) Security Guide, Ransomware Playbook Template.